This invention relates to a fault detection logic for an engine control system to discover any loss of thrust control of the control loop.
The control of engine thrust—and thus the control of the fuel flow required for the respective thrust—is effected in a known control system on the basis of the pressures measured at the inlet and at the outlet of the engine as the primary control parameter and the engine pressure ratio established therefrom. A positive difference between the command value and the actual value of the pressure ratio indicates an intended acceleration of the engine and, thus, an increase in fuel supply, while a negative value of the difference between the command value and the actual value of the engine pressure ratio signifies an intended deceleration of the engine and a corresponding decrease in fuel supply. Another primary control parameter is the low-pressure shaft speed.
Since the required thrust is to be achieved and maintained with minimum deviation, the fuel metering unit (FMU) is an extremely safety-relevant component, this unit delivering that quantity of fuel to the engine combustion chamber that corresponds to the thrust necessary to influence, as desired and with minimal fault, the movement and speed of a body attached to the engine.
For the detection of faults and operating states, an electronic engine controller (EEC) is integrated in the engine. The respective fault detection logic is capable of discovering certain incidents, such as the defect of a solenoid installed in the fuel metering unit for controlling the fuel flow or the absence of a feedback signal between the fuel metering unit and the electronic engine controller. If a fault is identified by the fault detection logic, the redundancy of the system allows the detection process to be repeated in another lane. If the initially detected fault is found to re-appear in the second lane, appropriate measures will be taken to eliminate the fault, or the engine will be shut down, as applicable.
In certain cases—for example if voltage conditions in the solenoid system of the fuel metering unit are affected by power supply deficiencies resulting from defects in connecting leads, connectors or similar items—the fault detection logic will not be able to sense the resultant variations in fuel flow. This inability manifests itself in a departure of the actual value of thrust and engine pressure ratio from the specified command value which is not recognized as fault by the fault detection logic. In other words, this type of control which uses a primary control parameter, here the engine pressure ratio, will fail to detect an overshoot or undershoot in thrust which is unrelated to the specified command value. If an engine fails to respond as a result of such a control behavior, i.e. a loss of thrust control without reaction of the engine controller or without indication of the malfunction, catastrophic consequences may occur. For example during the take-off run, an aircraft powered by an engine controlled according to the described state of the art can overshoot the end of the runway if excessive thrust occurs which is undetected by the control system, or it may depart from the runway if the thrust delivered by the two engines is asymmetrical. Undetected excessive thrust of one of the two engines is also critical shortly before touchdown, in particular, since the thrust asymmetry resulting therefrom may cause the aircraft to leave the runway. This situation, in which a fuel quantity is delivered to the engine combustion chamber which departs from the specified command value, is also termed loss of thrust control (LOTC). Since the fault detection system does not recognize this fault, catastrophic consequences as those described above may occur. Generally, a loss of thrust control may occur throughout the flight, however, the consequences can be more serious in the above situations than, for example, at great altitude.